arno/isso - isso - Gitea: Git with a cup of tea

Commit Graph

Author	SHA1	Message	Date
Martin Zimmermann	6c06b69dc5	another approach to fix #40 (return 403 on false Content-Type) When an attacker uses a <form> to downvote a comment, the browser should add a `Content-Type: ...` header with three possible values: * application/x-www-form-urlencoded * multipart/form-data * text/plain If the header is not sent or requests `application/json`, the request is not forged (XHR is restricted by CORS separately).	11 years ago
Martin Zimmermann	f0ee0a18b1	move unittest helpers into a separate file	11 years ago

Author

SHA1

Message

Date

Martin Zimmermann

6c06b69dc5

another approach to fix #40 (return 403 on false Content-Type)

When an attacker uses a <form> to downvote a comment, the browser
*should* add a `Content-Type: ...` header with three possible values:

    * application/x-www-form-urlencoded
    * multipart/form-data
    * text/plain

If the header is not sent or requests `application/json`, the
request is not forged (XHR is restricted by CORS separately).

Martin Zimmermann

f0ee0a18b1

move unittest helpers into a separate file

2 Commits (f50b0b0ffbf133d2d24206d6bd89be53d54642d5)